The WPFunnels WordPress plugin is vulnerable to stored cross‑site scripting through the 'wpf_optin_form' shortcode, specifically the 'button_icon' parameter. Because the plugin does not properly sanitize or escape user supplied data, an authenticated attacker with contributor level access can store malicious scripts into a page. When any visitor loads that page, the stored script executes in their browser, potentially allowing the attacker to perform client‑side attacks such as cookie theft, session hijacking, defacement, or redirection.

This flaw affects WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell, a plugin by getwpfunnels. All released versions up to and including 3.7.9 are impacted. Users of 3.8.0 or later, if available, are not affected.

The CVSS base score of 6.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need valid contributor‑level credentials to inject the payload; therefore, the attack vector is internal, authenticated. Once injected, the script executes automatically whenever a page containing the 'wpf_optin_form' shortcode is accessed, giving the attacker a broad reach within the site.